CVE-2021-24378
Autoptimize < 2.7.8 - Authenticated Stored XSS via File Upload
Vexday Risk Score
3Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS —EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
21 jun 2021Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
Productos afectados
Unknown · Autoptimize